CVE-2026-21642

NONE EPSS 5.9%
Published Jan 20, 20265mo ago · Modified Jun 17, 20262w ago
Find Similar
Published Jan 20, 2026 5mo ago
Last Modified Jun 17, 2026 2w ago

Description

HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the `banner-acl.php` and `channel-acl.php` scripts of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed.

Threat Intelligence

EPSS Exploit Probability
5.9% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
aquaplatformrevive_adserver* ≤6.0.4

References 1

  • hackerone.com https://hackerone.com/reports/3470970
    Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.